SecAlerts
c

codepeople

Security Risk Profile

42
/100
medium

Security Risk Score

Comprehensive risk assessment based on 95 vulnerabilities, EPSS scores, exploitation status, and remediation availability.

📅 Data spans from March 19, 2014 to present

95
Total CVEs
34
Critical+High
0
Exploited
18
Unpatched

Threat Assessment

Avg CVSS
6.4
Base severity
Avg EPSS
0%
Exploit probability
Unpatched
18
Critical/High
Risk Level
42/100
medium
🆕 2Fresh (<7d)📈 9 in Last 30 Days

Severity Distribution

Critical
6
High
28
Medium
58
Low
3

Exploit Likelihood

>50% chance
0
20-50%
0
5-20%
0
<5%
18

Age Distribution

Common Weaknesses (CWE)

1
XSS
50
2
SQL Injection
10
3
CSRF
8
4
Input Validation
2
5
Code Injection
1

Most Affected Products

1. CodePeople Calculated Fields Form Wordpress13
2. CodePeople Appointment Booking Calendar Wordpress11
3. CodePeople Contact Form Email Wordpress10
4. CodePeople Calculated Fields Form8
5. CodePeople Wp Time Slots Booking Form Wordpress7

Recent Vulnerabilities

See more →
CVE-2026-112379
CVSS 7.1high

WordPress Contact Form Email plugin <= 1.3.68 - Cross Site Scripting (XSS) vulnerability

Oct 22, 2026🔧 No Patch
CVE-2026-110701
CVSS 7.2high

CP Multi View Events Calendar <= 1.4.42 - Unauthenticated Stored Cross-Site Scripting via 'CalendarTitle' Parameter

Oct 16, 2026🔧 No Patch
CVE-2026-109901
CVSS 8.5high

WordPress CP Multi View Event Calendar plugin <= 1.4.41 - SQL Injection vulnerability

Oct 14, 2026🔧 No Patch
CVE-2026-95598
CVSS 7.1high

WordPress Search in Place plugin <= 1.5.5 - Cross Site Scripting (XSS) vulnerability

Oct 9, 2026🔧 No Patch
CVE-2026-103909
CVSS 6.1medium

Calculated Fields Form <= 5.5.1.5 - Reflected DOM-Based Cross-Site Scripting via URL Parameter Substitution in Calculated Field Equation

Oct 3, 2026🔧 No Patch
CVE-2026-100184
CVSS 4.7medium

Calculated Fields Form <= 5.5.1.3 - Reflected DOM-Based Cross-Site Scripting via 'x' URL Query Parameter via Text Area Predefined Value

Oct 1, 2026🔧 No Patch
CVE-2026-96573
CVSS 7.2high

Appointment Hour Booking <= 1.5.97 - Unauthenticated Stored DOM-Based Cross-Site Scripting via Booking Form Single-Line Field via Schedule Calendar List Renderer

Oct 1, 2026🔧 No Patch
CVE-2026-100179
CVSS 6.1medium

Calculated Fields Form <= 5.5.1.3 - Reflected DOM-Based Cross-Site Scripting via 'x' URL Parameter via setChoices()

Oct 1, 2026🔧 No Patch
CVE-2026-95529
CVSS 7.1EPSS 0%high

WordPress Calculated Fields Form plugin <= 5.5.1.1 - Cross Site Scripting (XSS) vulnerability

Sep 23, 2026🔧 No Patch
CVE-2026-13335
CVSS 6.4medium

CodePeople Post Map for Google Maps <= 1.2.6 - Authenticated (Contributor +) Stored Cross-Site Scripting via 'cpm_point' Post Meta

Jun 27, 2026🔧 No Patch

Monitor codepeople in Real-Time

Get instant alerts when new vulnerabilities are discovered. Stay ahead of security threats with SecAlerts.

Powered bySecAlerts

Monitor Your Software Stack in Real-Time

Get instant alerts when vulnerabilities are discovered in your software stack. Stay ahead of security threats with SecAlerts.

© 2026 SecAlerts Pty Ltd. All rights reserved.